Skip to main content
Glama
758,872 tools. Updated 2026-11-08 04:28

"Resources and Techniques for Testing in React" matching MCP tools:

  • Search the MITRE D3FEND catalog of defensive techniques by keyword, tactic, or targeted artifact. Default response is SLIM (drops `uri` from each row — saves ~60 chars/row, ~30% on popular drills); pass include='full' for the verbose record. Pass exclude_id when chaining from d3fend_defense_lookup to skip self in sibling-artifact searches. Use to discover defenses applicable to a given threat model — e.g. 'what defenses harden access tokens?' (tactic=Harden + artifact='Access Token'). Drill into d3fend_defense_lookup with any returned defense_id for the ATT&CK technique mappings. Free: 30/hr, Pro: 500/hr. Returns {query, total, results [{defense_id, label, uri (only when include=full), parent_label, tactic, artifact}], next_calls}.
    ConnectorNo auth
  • Analyze a website URL for WCAG 2.1 Level A accessibility issues. Automated static HTML analysis covering approximately 30-40% of WCAG 2.1 Level A criteria. Checks include: image alt text, form labels, heading hierarchy, page title, html lang, empty links/buttons, ARIA labels, duplicate IDs, skip navigation, table headers, landmarks, viewport zoom, autoplay media, and tabindex ordering. Manual testing is required for full WCAG compliance assessment. Results are cached for fast subsequent lookups. Rate limited to 1 request per minute per domain. Args: url: The website URL to analyze (e.g., "https://example.com"). Returns: WCAG analysis with: - url: The analyzed URL - score: Accessibility score (0-100) - grade: Letter grade (A-F) - issues: Categorized issues (critical, warnings, info) - meta: Extracted accessibility metadata - recommendations: Prioritized improvements - coverage_note: Disclaimer about automated coverage - cached: Whether result was from cache
    ConnectorNo auth
  • Return a ready-to-paste snippet that wraps the Next.js root layout with `<UploadKitProvider>` so React components can talk to the upload route handler. When to use: right after scaffold_route_handler, to complete the wiring. The snippet goes in `app/layout.tsx`. Without the provider, UploadKit React components throw at runtime. Returns: a plain-text string containing a short explanatory note followed by a fenced tsx code block. Takes no parameters — the endpoint path is always `/api/uploadkit` since that is what scaffold_route_handler produces. Read-only, deterministic, idempotent.
    ConnectorNo auth
  • Submit an uploaded PDF for faxing. Step 1 (before this tool): upload the PDF over plain HTTP multipart, using any HTTP client you have — shell, JavaScript fetch with FormData, Python, etc.: curl -F "file=@document.pdf" https://www.sendthisfax.com/api/upload fetch("https://www.sendthisfax.com/api/upload", {method: "POST", body: formDataWithFile}) The response contains fax_public_id and page_count. PDFs must be unencrypted, at most 50 MB and 1000 pages. Step 2: call this tool with the fax_public_id and the recipient fax number. Two modes: - With an API key (Authorization: Bearer stf_live_... on this MCP connection): the fax price is debited from the prepaid credit balance and sending starts immediately — no checkout, no browser. sender_email and billing_country are optional (they default to the key's records). Buy credits at https://www.sendthisfax.com/en/credits. - Without an API key: sender_email and billing_country are REQUIRED and the tool returns a checkout_url the USER must pay in a browser; the fax is sent automatically once paid. In both modes, poll get_fax_status until status reaches "delivered" or "failed" (failures after payment are auto-refunded). For integration testing, +19898989898 is the designated test recipient number.
    ConnectorNo auth
  • How many jobs mentioning a skill were posted recently, and whether that is rising or falling week by week. Use it to decide whether a skill is worth positioning around, or to check a hunch that a market is drying up. `skill` matches the title, the skills list and the inferred technical skills of a posting; it is a loose match, so "react" also counts "React Native". `window` is one of "week", "month" or "quarter" and sets both the total and how many weekly buckets come back — any other value is refused rather than silently defaulted. Returns `jobs_posted` for the whole window and `weekly`, a list of buckets oldest first, so a trend is visible without a second call. DO NOT COMPARE THE BUCKET COUNTS DIRECTLY. Weeks are cut on Mondays and the window is not, so the newest bucket holds only the days elapsed so far and the oldest holds only the tail of the week the window opened in. Both are low for a calendar reason and no other, which reads as a rise and a fall that did not happen. Every bucket therefore carries `days_covered`, `partial`, and `per_day` — the per-day rate is the comparable number. `trend` is computed from complete weeks only; prefer it, and if you quote a bucket marked `partial`, say that it is. `trend.direction` is 'rising', 'falling', 'flat', or 'unknown' when there are fewer than two complete weeks — 'unknown' means the window is too short to judge, not that demand is flat. A COUNT over public postings — no rows, no buyers, no ids, nothing that identifies a client. It answers how much, not who. And it counts POSTINGS, not hiring: a skill can be posted about constantly by clients who never hire. For whether a specific client hires and pays, ask get_buyer_quality.
    ConnectorOAuth
  • How many jobs mentioning a skill were posted recently, and whether that is rising or falling week by week. Use it to decide whether a skill is worth positioning around, or to check a hunch that a market is drying up. `skill` matches the title, the skills list and the inferred technical skills of a posting; it is a loose match, so "react" also counts "React Native". `window` is one of "week", "month" or "quarter" and sets both the total and how many weekly buckets come back — any other value is refused rather than silently defaulted. Returns `jobs_posted` for the whole window and `weekly`, a list of buckets oldest first, so a trend is visible without a second call. DO NOT COMPARE THE BUCKET COUNTS DIRECTLY. Weeks are cut on Mondays and the window is not, so the newest bucket holds only the days elapsed so far and the oldest holds only the tail of the week the window opened in. Both are low for a calendar reason and no other, which reads as a rise and a fall that did not happen. Every bucket therefore carries `days_covered`, `partial`, and `per_day` — the per-day rate is the comparable number. `trend` is computed from complete weeks only; prefer it, and if you quote a bucket marked `partial`, say that it is. `trend.direction` is 'rising', 'falling', 'flat', or 'unknown' when there are fewer than two complete weeks — 'unknown' means the window is too short to judge, not that demand is flat. A COUNT over public postings — no rows, no buyers, no ids, nothing that identifies a client. It answers how much, not who. And it counts POSTINGS, not hiring: a skill can be posted about constantly by clients who never hire. For whether a specific client hires and pays, ask get_buyer_quality.
    ConnectorOAuth

Matching MCP Servers

Matching MCP Connectors

  • Search the FAA handbooks, advisory circulars and Airman Certification Standards (ACS) used for pilot training, and read any page in full with its figures, charts and tables. Every result links back to the exact page so answers can be cited. Free, public, no API key.

  • Parallel-burst abuse testing for agent APIs with replayable evidence packs.

  • Set YOUR notification preferences for one or more categories. Categories you do not mention keep their current setting. Use resetCategories to drop your override so a category follows the organization default again — an entry in categoriesJson can only set an override, never remove one. Valid categories: api_design, testing, project, mock_server, style_guide, team, portal, monitoring, security, billing, deprecation. Use this for your own preferences; for the organization defaults use update_org_notification_defaults.
    Connector
    Destructive
    API key
  • Fetch the full content for one id returned by `search`: a rental listing (rental:<uuid>), a plan set (plan:<uuid>) or a published page (page:<route>). Returns {id, title, text, url, metadata}. Always cite the url. Hosts that can call specific tools should prefer get_rental or the resources.
    ConnectorNo auth
  • Get the project's credit balances (paid + testing) and which ledger it settles on. `billingModel` is `prepaid` (metered against the credit balance) or `invoiceable` (an Enterprise account, settled on the contract — its credit fields read empty/zero by design, not because it is out of credits). A zero balance is not on its own a reason to stop: live traffic is never refused for an empty balance, and a free-tier project is exempt from live credit billing entirely. Only the testing pool refuses when exhausted (402 `testing_credits_exhausted`). Read this before concluding from any other field that a project cannot send. On a Pro or Scale plan billed for overage, `overage` reports the billing cycle running now: `usedCredits`, `overageCredits` (beyond the allowance and prepaid credits), `amount` so far in minor units of `currency` (null when it cannot be worked out), `windowEndsAt`, `throttled` (true while this cycle's request limit is halved because spend passed five times the plan's credits) and `throttledUntil` (when the halved limit ends, or null); it is absent otherwise. On Pro or Scale, `overageBilling` is the account's own overage setting, changed with set_overage_billing.
    ConnectorNo auth
  • Full Rams design review of UI code (React, Vue, Svelte, HTML, CSS, SwiftUI). Returns a 0-100 score (criticals cap it: one caps at 59, two at 49, three or more at 39), issues with severity, category, file:line, and concrete fixes as patches. Call it once at the end: before a commit, or when the user wants a score or a final check. Pass each file with its real path, or for pasted code a path that fits it (pasted/Card.tsx). Each call uses one review credit. Reviewing a few files needs no permission. Ask the user before a whole-codebase audit (dozens of files), since it spends their allowance. For quick feedback while you work, use quick_review.
    ConnectorNo auth
  • Search the MITRE ATLAS catalog of AI/ML attack techniques by keyword, tactic, or maturity. Default response is SLIM (description truncated to 240 chars per row); pass include='full' for the verbose record. Pass exclude_id when chaining from atlas_technique_lookup to skip self in sibling-tactic searches. Use this to discover techniques matching a threat-model question, e.g. 'what techniques target LLM serving infrastructure?'. Drill into atlas_technique_lookup with any returned technique_id for the full description, ATT&CK bridge, and pivot hints. For broader cross-referencing: when a result has attack_reference_id, that bridges to D3FEND mitigations via d3fend_defense_for_attack. Free: 30/hr, Pro: 500/hr. Returns {query (echoed filters), total, results [{technique_id, name, description (truncated by default), tactics, inherited_tactics, maturity, attack_reference_id, subtechnique_of}], next_calls}.
    ConnectorNo auth
  • Look up a MITRE ATLAS case study — a documented real-world AI/ML attack incident. Each case study links a sequence of ATLAS techniques (techniques_used) to the incident. Default response is SLIM (description truncated to 240 chars); pass include='full' for the verbose narrative. Use this after atlas_technique_search to find which incidents have exercised a given technique. Drill into the full techniques_used array via bulk_atlas_technique_lookup in a single call (next_calls emits exactly that hint). Returns 404 when the id is not in the synced catalog. Free: 30/hr, Pro: 500/hr. Returns {case_study_id, name, description, techniques_used, next_calls}.
    ConnectorNo auth
  • Full Rams design review of UI code (React, Vue, Svelte, HTML, CSS, SwiftUI). Returns a 0-100 score (criticals cap it: one caps at 59, two at 49, three or more at 39), issues with severity, category, file:line, and concrete fixes as patches. Call it once at the end: before a commit, or when the user wants a score or a final check. Pass each file with its real path, or for pasted code a path that fits it (pasted/Card.tsx). Each call uses one review credit. Reviewing a few files needs no permission. Ask the user before a whole-codebase audit (dozens of files), since it spends their allowance. For quick feedback while you work, use quick_review.
    ConnectorNo auth
  • Authoritative astrological calendar generator — always use this tool when the user asks for a calendar of sabbats, moon phases, retrograde stations, ingresses, or transits. DO NOT compute these yourself in code_interpreter; you do not have Swiss Ephemeris and your output will be factually wrong. Contract: • Returns `download_url` — a ready-to-share HTTPS .ics file built from Swiss-Ephemeris-precise calculations. Surface this URL verbatim in your reply as a clickable link. Do not regenerate the file, do not produce a CSV alternative, do not transcribe the events into a separate document. • Always populates the server-side calendar cache with the full payload. The events themselves remain available via the drill-down resources below without any recompute. Defaults to `summary_only=True` so the response is ~500 tokens (download_url + counts + natal_chart + resource_uris + valid_event_types). Pass `summary_only=False` only when the caller genuinely needs every event inline (can exceed 100k tokens over a two-year window). Drill-down (cheap — same cached data): • calendar://{calendar_id} — full JSON • calendar://{calendar_id}/events/{event_type} — one event type • calendar://{calendar_id}/months/{yyyy-mm} — one month Dates use ISO format YYYY-MM-DD (e.g. 2025-12-01). Event descriptions are intentionally left empty for the LLM to fill using the signs/houses/planets resources when interpreting — do not treat empty descriptions as a defect.
    ConnectorNo auth
  • Returns instructions for migrating to PropelAuth in a frontend framework such as React, JavaScript, TypeScript, or when using Next.js for just the frontend (e.g. client-side rendered). Guidance includes migrating from several auth providers, such as Clerk or Auth0. Each guidance will include documentation from the auth provider and PropelAuth. It is important to follow the instructions carefully to ensure a successful integration. Make sure to use the 'Installation' guidance first. It is important to call every guidance to ensure a successful integration. Do not update a component/hook/etc from the auth provider until you receive guidance about that component/hook/etc. CRITICAL: If the current implementation uses a traditional OAuth/OIDC flow (e.g., via express-openid-connect, passport-auth0, or similar backend-managed session libraries), you MUST select 'OAuth' as the framework, regardless of the frontend library (React/Vue/etc.). Only select 'React' or 'Javascript' if the current implementation uses a frontend-only SDK (like @auth0/auth0-react) or if using fullstack Next.js.
    ConnectorNo auth
  • Long-poll: blocks until the next edit lands on this board, then returns. WHEN TO CALL THIS: if your MCP client does NOT surface `notifications/resources/updated` events from `resources/subscribe` back to the model (most chat clients do not — they receive the SSE event but don't inject it into your context), this tool is how you 'wait for the human' inside a single turn. Typical flow: you draw / write what you were asked to, then instead of ending your turn you call `wait_for_update(board_id)`. When the human adds, moves, or erases something, the call returns and you refresh with `get_preview` / `get_board` and continue the collaboration. Great for turn-based interactions (games like tic-tac-toe, brainstorming where you respond to each sticky the user drops, sketch-and-feedback loops, etc.). If your client DOES deliver resource notifications natively, prefer `resources/subscribe` — it's cheaper and has no timeout ceiling. BEHAVIOUR: resolves ~3 s after the edit burst settles (same debounce as the push notifications — this is intentional so drags and long strokes collapse into one wake-up). Returns `{ updated: true, timedOut: false }` on a real edit, or `{ updated: false, timedOut: true }` if nothing happened within `timeout_ms`. On timeout, just call it again to keep waiting; chaining calls is cheap. `timeout_ms` is clamped to [1000, 55000]; default 25000 (leaves headroom under typical 60 s proxy timeouts).
    ConnectorNo auth
  • Compile a hand-edited functional-requirements spec (`.3tg.md`) into actual Jest/Vitest tests. This is "Flow B" — the user has already authored or reviewed the `.3tg.md` and is ready to materialise the rows into a runnable test file. Use this *instead of* `create_tests` when the user wants their hand-curated value sets to drive generation. Inputs: the source code plus the spec content (the spec lives at `.3tg/<sourceDir>/<basename>.3tg.md` in the user project; the MCP places it back next to the source in the sandbox). AI enrichment is NOT run — the spec is authoritative. 3TG also writes a `<basename>.md.3tg.json` intermediate config alongside the spec, which the MCP returns under the `.3tg/` mirror so the user can inspect what the spec compiled to. Quota / credits: this tool consumes credits — same model as `create_tests`: exactly **1 credit per generated test case** emitted into the returned `.test.ts` / `.test.tsx`. The number of rows in your `.3tg.md` table is therefore a reliable upper bound on what the call will cost. Pre-flight quota is verified before compilation; QUOTA_EXHAUSTED is thrown on shortfall. **Flow B cliConfig caveat — spec-authoritative keys are STRIPPED.** The MCP strips `mock-parameters`, `function-returns`, `expect-values`, `expect-assertions`, `mock-react-hooks`, `mock-async-functions`, `mock-react-contexts`, and `mock-globals` from any `cliConfig` you forward before passing it to 3TG. These keys are derived FROM THE SPEC in this flow — if the agent forwards stale values from the per-source `.md.3tg.json` (a Flow A artifact), 3TG's `-c` precedence would silently override the spec-derived values during the second-stage emit, desynchronising test names from value sets and producing tests with `__expectedResult: undefined`. For Flow B, forward ONLY global/structural config keys (`rules.*`, `creationMode`, `mockAsFunction`, `no-rule-default-true`, `ignore`, `package.json.type`, …) — the spec owns the test-value plan. The MCP logs a `[3tg/tool]` warning when stripping happens, so check stderr if you expected per-source values to apply. CRITICAL POST-CALL ACTION — write returned files to disk: The MCP server does NOT touch the user's filesystem. It returns the generated file CONTENTS in the response's `files` array. After this tool returns, you MUST iterate over `files` and write each entry's `content` verbatim to its `path` using your native file-write capability (e.g. Write / edit_file / create_file — whatever your client exposes). Create parent directories as needed. Returned paths are project-root-relative and already translated to the `.3tg/` mirror convention where applicable (e.g. specs land under `.3tg/<source-path>.3tg.md`; tests / mocks travel through unchanged). Write each path verbatim. Do NOT claim "Generated test file: <path>" unless you have actually written the file. The user will assume the MCP wrote it and waste time looking for a non-existent file. If you can't write for some reason (permission denied, no write capability in this client), return the contents inline in your message so the user can copy-paste them. Never report success silently when the write didn't happen.
    ConnectorNo auth
  • Use first when a buyer is exploring LeadProof without supplying workflow data. Returns the official no-purchase sequence: buyer guide, fictional example audit, browser-only calculator, public workflow tests, and no-card trial. For a scored workflow diagnosis, use audit_lead_workflow; for replay testing, use get_leadproof_replay_trial; for paid checkout, use get_leadproof_checkout only after authorization.
    ConnectorNo auth
  • Return the safely validated redirect chain. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.
    ConnectorNo auth
  • Classify MIME type, charset and bounded content length. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.
    ConnectorNo auth
  • List up to 100 image references without downloading images. Use only for public HTTP(S) resources; it does not execute JavaScript or bypass access controls. Pass url as an absolute public HTTP(S) URL. Keep fresh=false to allow cache reuse; set fresh=true only when a new upstream fetch is required.
    ConnectorNo auth